Voluntary Participation in Cyber-insurance Markets

The study of cyber-insurance, both as a method for transferring residual cyber-security risks, and as an incentive mechanism for internalizing the externalities of security investments in interdependent systems, has received considerable attention in the literature. On one hand, it has been shown that competitive insurance markets, even though ensuring user participation, fail to improve the overall network security. On the other hand, existing literature illustrates how a monopolist insurer can induce socially optimal behavior (under a binary decision model). Nevertheless, participation in the latter market is assumed to be mandatory. In this paper, we ask the question of whether socially optimal security investments in an interdependent system can be incentivized through non-compulsory insurance. To do so, we will not consider the competitive market model due to its inefficiencies, and focus instead on the role of a monopolist profitneutral insurer acting as a regulator in implementing the socially optimal investment profile in an interdependent security game. We first propose an insurance design mechanism that allows a continuous decision model. We then study users’ participation incentives under this mechanism. We show that due to the non-excludable nature of security as a public good, there may exist scenarios in which it is impossible to guarantee that users voluntarily purchase insurance. We discuss the implication of this impossibility and possible ways to circumvent it.